On 1/7/24 06:24, Mimi Zohar wrote:
On Fri, 2024-01-05 at 12:22 -0800, Tushar Sugandhi wrote:
@@ -194,6 +206,15 @@ static int ima_update_kexec_buffer(struct notifier_block *self,
return ret;
}
+ buf_size = ima_get_binary_runtime_size();
+ scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
+ "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;",
+ kexec_segment_size, buf_size);
+
+ ima_measure_critical_data("ima_kexec", "kexec_execute",
+ ima_kexec_event, strlen(ima_kexec_event),
+ false, NULL, 0);
+
Please consider including the number of measurement records as well.
Will do. I think that would be valuable information.
Per my understanding, I will have to use the function
ima_show_measurements_count() or ima_show_htable_value() to get the
number of measurement records value[1]. So I will have to expose that
function from "ima_fs.c" to "ima_kexec.c". Hope that's ok.
[1]
https://elixir.bootlin.com/linux/latest/sourcesecurity/integrity/ima/ima_fs.c
static ssize_t ima_show_measurements_count(struct file *filp,
char __user *buf,
size_t count, loff_t *ppos)
{
return ima_show_htable_value(buf, count, ppos, &ima_htable.len);
I don't see a need to expose this function. ima_htable is defined in ima.h.
You can read the ima_htable.len directly, as ima_show_htable_value does.
Agreed. Thanks for the pointer.
That's what I concluded too when I was implementing this change.
I will use ima_htable.len directly.
~Tushar
